Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    "Source OS" -> firewall logs -> remote syslog?

    Scheduled Pinned Locked Moved Firewalling
    2 Posts 2 Posters 191 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • T
      Tantamount
      last edited by

      I'm hoping to remotely retrieve "Source OS" data from the firewall logs. Ideally I'd like this turned on for all rules without having to manually edit each one, but currently I've enabled it for a few. Currently, logging gets sent to a remote server via syslog, with raw entries that look like this:

      64,,,1458836143,igb0,match,pass,in,4,0x0,,44,1246,0,none,6,tcp,5,1.2.3.4,8.8.8.8,57444,25565,0,S,1296312405,,64240,,mss;nop;wscale;nop;nop;sackOK
      

      For "Source OS" enabled rules that trigger, will the "Source OS" field get appended or inserted before being passed off to syslog for delivery to the remote server?

      1 Reply Last reply Reply Quote 0
      • jimpJ
        jimp Rebel Alliance Developer Netgate
        last edited by

        The source OS isn't recorded in the logs as far as I'm aware.

        You could set a specific rule to match a specific source OS and then maybe go by whatever that rule's tracking ID is, but the actual OS info won't be in the log data.

        https://docs.netgate.com/pfsense/en/latest/monitoring/filter-log-format-for-pfsense-2-2.html

        Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

        Need help fast? Netgate Global Support!

        Do not Chat/PM for help!

        1 Reply Last reply Reply Quote 0
        • First post
          Last post
        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.